Disable lowering to StringAdd due to various issues.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/566303003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23961 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/compiler/js-typed-lowering.cc

@@ -232,6 +232,11 @@ Reduction JSTypedLowering::ReduceJSAdd(Node* node) {
     r.ConvertInputsToNumber();
     return r.ChangeToPureOperator(simplified()->NumberAdd());
   }
+#if 0
+  // TODO(turbofan): Lowering of StringAdd is disabled for now because:
+  //   a) The inserted ToString operation screws up valueOf vs. toString order.
+  //   b) Deoptimization at ToString doesn't have corresponding bailout id.
+  //   c) Our current StringAddStub is actually non-pure and requires context.
   if (r.OneInputIs(Type::String())) {
     // JSAdd(x:string, y:string) => StringAdd(x, y)
     // JSAdd(x:string, y) => StringAdd(x, ToString(y))
@@ -239,6 +244,7 @@ Reduction JSTypedLowering::ReduceJSAdd(Node* node) {
     r.ConvertInputsToString();
     return r.ChangeToPureOperator(simplified()->StringAdd());
   }
+#endif
   return NoChange();
 }
 

test/cctest/compiler/test-js-typed-lowering.cc

@@ -186,6 +186,8 @@ static IrOpcode::Value NumberToI32(bool is_signed) {
 }
 
 
+// TODO(turbofan): Lowering of StringAdd is disabled for now.
+#if 0
 TEST(StringBinops) {
   JSTypedLoweringTester R;
 
@@ -204,6 +206,7 @@ TEST(StringBinops) {
     }
   }
 }
+#endif
 
 
 TEST(AddNumber1) {

test/mjsunit/mjsunit.status

@@ -70,15 +70,6 @@
   'harmony/block-let-crankshaft': [PASS, NO_VARIANTS],
   'harmony/empty-for': [PASS, NO_VARIANTS],
 
-  # TODO(mstarzinger): Typed lowering screws up valueOf vs. toString order.
-  'regress/regress-760-1': [PASS, NO_VARIANTS],
-  'regress/regress-760-2': [PASS, NO_VARIANTS],
-  'harmony/proxies-json': [PASS, NO_VARIANTS],
-
-  # Unused code is optimized away, think about fixing the test case.
-  'string-oom-concat': [PASS, NO_VARIANTS],
-  'regress/regress-crbug-357052': [PASS, NO_VARIANTS],
-
   # Some tests are over-restrictive about object layout.
   'array-constructor-feedback': [PASS, NO_VARIANTS],
   'array-feedback': [PASS, NO_VARIANTS],

test/mjsunit/regress/regress-crbug-357052.js

@@ -7,5 +7,6 @@ function f() {
   for (var i = 0; i < 30; i++) {
     str += "abcdefgh12345678" + str;
   }
+  return str;
 }
 assertThrows(f);

test/mjsunit/string-oom-concat.js

@@ -7,6 +7,7 @@ function concat() {
   for (var i = 0; i < 100; i++) {
     a += a;
   }
+  return a;
 }
 
 assertThrows(concat, RangeError);